CVE-2025-3987

medium · 5.3

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

5.3

CVSS

10.5%

EPSS (exploit prob.)

96th

EPSS percentile

2025-04-27

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
totolink	n150rt_firmware	3.4.0-b20190525
totolink	n150rt	2.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/N150RT/RCE_formWsc
https://vuldb.com/?ctiid.306323
https://vuldb.com/?id.306323
https://vuldb.com/?submit.557938
https://www.totolink.net/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-3987